An authentication bypass vulnerability (CWE-306) exists in GitHub Enterprise Server versions before 3.21. When external authentication providers are enabled, the signup endpoint fails to enforce authentication restrictions, allowing unauthenticated attackers to create local user accounts and establish sessions without identity provider validation. The vulnerability requires network access to the affected GHES instance. The created accounts are limited to default base permissions. GitHub fixed this issue in versions 3.20.2, 3.19.6, 3.18.9, 3.17.15, and 3.16.18.

An attacker with network access to a vulnerable GitHub Enterprise Server instance can bypass external authentication controls to create local user accounts with default base permissions. This could allow unauthorized access to the instance with limited privileges, potentially enabling further reconnaissance or privilege escalation depending on the environment and configuration.

This vulnerability is fixed in GitHub Enterprise Server versions 3.20.2, 3.19.6, 3.18.9, 3.17.15, and 3.16.18. Users should upgrade to one of these fixed versions or later to remediate the issue. Since this is an on-premises product, patching the affected instances is required. No vendor advisory content contradicts this; therefore, upgrading is the recommended mitigation.